SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment Integrity Information Act of 2019
Summary
A May 15, 2023 memorandum from SBA Office of Inspector General, from Inspector General Hannibal “Mike” Ware to Administrator Isabella Casillas Guzman, transmitting the independent auditors’ report on SBA’s Fiscal Year 2022 compliance with the Payment Integrity Information Act of 2019 (Report 23-07). It states that KPMG LLP found SBA was not compliant with 9 of the 10 reporting requirements, citing the risk assessment for the Restaurant Revitalization Fund and Shuttered Venue Operators Grant, the sampling and estimation plans for disaster assistance loans, COVID-19 EIDL, EIDL advances and the Paycheck Protection Program, 7(a) loan guaranty purchases, and PPP guaranty purchases and forgiveness. The Inspector General’s review was not an audit and expresses no opinion on SBA’s compliance. SBA concurs with the recommendations.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment Integrity Information Act of 2019.”
Original at legacy.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-independent-auditors-report-on-sba-s-fiscal-year-2022-compliance-w-dc636f35a8/
, SHA-256 1b989f15cdf6c1ef3b5832eafe4ed52f75dc6ddfc9c7073bbe57c05da7c11411.Full text
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
DATE: May 15, 2023
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the
Payment Integrity Information Act of 2019 (Report 23-07)
This independent auditors’ report on the U.S. Small Business Administration’s (SBA) improper
payment reporting is required by the Payment Integrity Information Act of 2019. We contracted
with the independent certified public accounting firm KPMG LLP to conduct a performance audit
of SBA’s Fiscal Year (FY) 2022 compliance with the Act. The auditor was engaged to review the
payment integrity section of SBA’s Agency Financial Report Fiscal Year 2022 (AFR) and
accompanying materials to determine whether the agency complied with the reporting
requirements under the Act.
KPMG was engaged to conduct the audit in accordance with consulting services standards
established by the American Institute of Certified Public Accountants. The audit also complied
with standards applicable to government performance audits issued by the Comptroller General
of the United States and the Council of the Inspectors General on Integrity and Efficiency
Guidance for Payment Integrity Information Act Compliance Reviews.
In the report, KPMG auditors found SBA was not compliant with 9 of the 10 reporting
requirements under the Act and Office of Management and Budget (OMB) guidance. Specifically,
SBA is not compliant with the Act because:
• The agency’s risk assessment methodology did not consider certain identified risk
factors to adequately conclude whether the Restaurant Revitalization Fund,
Shuttered Venue Operators Grant, and the payments for covered loans in the 7(a)
and 504 Certified Development Company loan guaranty programs under the debt
relief assistance program were likely to include improper and unknown payments
above or below the statutory threshold.
409 3rd Street SW, Washington, DC 20416 • phone (202) 205-6586 • fax (202) 205-7382
• The sampling and estimation methodology plans were not appropriate for the SBA
disaster assistance loans, COVID-19 Economic Injury Disaster Loans (COVID-19 EIDL),
and Economic Injury Disaster Loan Targeted Advance programs and activities. In
addition, for COVID-19 EIDLs, EIDL advances, and the Paycheck Protection Program
(PPP), SBA did not design and implement adequate sample review procedures to
produce reliable sample results that could be used to develop accurate improper and
unknown payment estimates. As a result, SBA’s improper payment and unknown
payment rate estimates were not accurate or reliable for the disaster assistance
loans, COVID-19 EIDLs, EIDL advances, and the PPP. Due to the unreliable estimates,
these programs and activities did not comply with the requirement to report
improper and unknown payment rate estimates of less than 10 percent.
• SBA did not demonstrate improvements to payment integrity for 7(a) loan guaranty
purchases because the improper payment estimate increased between fiscal years
2021 and 2022, and
• SBA did not publish improper and unknown payment estimates, corrective action
plans, and reduction targets within the AFR and accompanying materials for PPP loan
guaranty purchases and forgiveness activities. While SBA presented payment integrity
information within its FY 2022 AFR and accompanying materials under PPP, this
information presented was only for PPP loan guaranty approvals. KPMG’s assessment
of PIIA compliance is based on all payment activities within the program including PPP
loan guaranty approvals, forgiveness, and purchases activities.
We reviewed KPMG’s report and related documentation and inquired of its representatives. Our
review, as differentiated from an audit in accordance with the Government Auditing Standards,
was not intended to enable us to express, and we do not express, opinions on SBA’s compliance
with the Act or internal control over improper payment reporting. KPMG is responsible for the
attached auditors’ report dated May 15, 2023 and the conclusions expressed.
Our oversight protocols include evaluation of major work products, attendance at critical
meetings, review of significant findings, and examination of related evidential matter. Our review
disclosed no instances where KPMG did not comply in all material respects with Government
Auditing Standards.
SBA indicates that it is committed to reducing the dollar amount of improper payments, ensuring
program integrity, and continuing to implement effective risk management procedures in
accordance with improper payment legislation, as well as guidance prescribed in OMB
Memorandum M-21-19, Appendix C to OMB Circular A-123, Requirements for Payment Integrity
Improvement.
2
SBA concurs with the recommendations made in this audit report and has provided comments in
response to those recommendations. The agency’s response is included in Appendix I of this
report. We provided a draft of KPMG’s report to SBA’s Chief Financial Officer and the Associate
Administrator for the Office of Capital Access.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
cc: Arthur Plews, Chief of Staff
Katherine Aaby, Associate Administrator, Office of Performance, Planning,
and the Chief Financial Officer
Patrick Kelley, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Therese Meers, General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls
Attachment
3
Performance Audit of the U.S. Small Business Administration’s Fiscal Year
2022 Compliance with the Payment Integrity Information Act of 2019
Prepared for: U.S. Small Business Administration, Office of Inspector General
Date: May 15, 2023
KPMG LLP
1801 K Street NW, Suite 12000
Washington DC 20006
Table of Contents
Auditors’ Report ......................................................................................................................... 3
I. Background .......................................................................................................................... 7
II. Objective, Scope, And Methodology..................................................................................... 8
III. Results And Conclusions ..................................................................................................... 9
IV. Findings ..............................................................................................................................11
A. Deficiencies In Internal Control .......................................................................................11
B. Recommendations ..........................................................................................................14
V. Appendix I: Management’s Response To Report ................................................................15
Page | 2
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Administrator
Inspector General
U.S. Small Business Administration
This report presents the results of our performance audit related to the U.S. Small Business
Administration’s (SBA’s) compliance with the requirements contained in the Payment Integrity
Information Act of 2019 (PIIA), section 3351(2). We performed our work between December 15,
2022 and May 15, 2023, and our results are as of May 15, 2023.
We conducted this performance audit in accordance with the standards applicable to
performance audits contained in the Government Auditing Standards (GAS) issued by the
Comptroller General of the United States. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings
and conclusions based on our audit objective. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objective.
In addition to GAS, we conducted this performance audit in accordance with the Statements on
Standards for Consulting Services established by the American Institute of Certified Public
Accountants (AICPA). This performance audit did not constitute an audit of SBA’s financial
statements, or an attestation level report as defined under generally accepted government
auditing standards (GAGAS) and AICPA standards for attestation engagements.
We leveraged the Council of the Inspectors General on Integrity and Efficiency Guidance
(CIGIE) for Payment Integrity Information Act Compliance Reviews (November 8, 2022), which
provides guidance regarding the fieldwork and reporting related to the performance audit
objective. The objective of our performance audit was to determine whether SBA complied with
the PIIA for fiscal year (FY) 2022.
Based on the results of our performance audit procedures, we have met our audit objective.
We determined that SBA was not compliant with PIIA due to the following:
• SBA’s risk assessment methodology did not consider certain identified risk factors to
adequately conclude whether the Restaurant Revitalization Fund (RRF), Shuttered
Venues Operator Grant (SVOG), and the payments for covered loans in the 7(a) and 504
loan guaranty programs under the Debt Relief Program were likely to include improper
and unknown payments above or below the statutory threshold.
• The sampling and estimation methodology plans (S&EMP) were not appropriate for the
Disaster Assistance Loans, COVID-Economic Injury Disaster Loans (COVID-EIDL), and
Economic Injury Disaster Loan Emergency Assistance Advance (EIDL Advance)
programs and activities. In addition, for COVID-EIDL, EIDL Advance, and Paycheck
Protection Program (PPP), SBA did not design and implement adequate sample review
procedures to produce reliable sample results that could be used to develop accurate
improper and unknown payment estimates. As a result, SBA’s improper payment and
KPMG LLP, a Delaware limited liability partnership and a member firm of Page | 3
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
unknown payment rate estimates were not accurate or reliable for the Disaster
Assistance Loans, COVID-EIDL, EIDL Advance, and PPP. Due to the unreliable
estimates, these programs and activities did not comply with the requirement to report
improper and unknown payment rate estimates of less than 10 percent.
• SBA did not demonstrate improvements to payment integrity for 7(a) loan guaranty
purchases as the improper payment estimate increased between FYs 2021 and 2022.
• SBA did not publish improper and unknown payment estimates, corrective action plans,
and reduction targets within the FY 2022 agency financial report (AFR) and
accompanying materials for PPP loan guaranty purchases and forgiveness activities.
While SBA presented payment integrity information within its FY 2022 AFR and
accompanying materials under “Paycheck Protection Loan Program (PPP)”, the
information presented was only for PPP loan guaranty approvals. Our assessment of
PIIA compliance is based on all payment activities within the program including PPP loan
guaranty approvals, forgiveness, and purchases activities.
See Table 1 for a summary of SBA’s compliance with the PIIA for FY 2022 for programs and
activities reported by SBA in the FY 2022 AFR or accompanying materials. As the payments for
covered loans in the 7(a) and 504 loan guaranty programs under the Debt Relief Program were
not reported by SBA in the FY 2022 AFR or accompanying materials, this program was not
included in Table 1.
Table 1. Summary of SBA’s PIIA Compliance
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Corrective Action Improvements to
Activity
Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
7(a) Loan
Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable
Approvals
7(a) Loan
Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant
Purchases
504 Certified
Development Not Not
Compliant Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Loan Applicable Applicable
Approvals
Disaster
Not Not Not Not
Assistance Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant
Loans
COVID-
Economic
Not Not Not Not Not
Injury Disaster Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Applicable Compliant
Loan (COVID-
EIDL)
Page | 4
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Corrective Action Improvements to
Activity
Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
Economic
Injury Disaster
Loan
Not Not Not Not Not
Emergency Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Applicable Compliant
Assistance
(EIDL
Advance)
Paycheck
Not Not Not Not Not Not Not Not Not Not
Protection
Compliant Compliant Applicable Applicable Compliant Compliant Compliant Applicable Compliant Compliant
Program (PPP)
Restaurant
Not Not Not Not Not Not Not Not Not
Revitalization Compliant
Applicable Applicable Compliant Applicable Applicable Applicable Applicable Applicable Applicable
Fund (RRF)1
Shuttered
Venues Not Not Not Not Not Not Not Not Not
Operator Compliant
Applicable Applicable Compliant Applicable Applicable Applicable Applicable Applicable Applicable
Grant (SVOG)1
The compliance requirements 2a and 2b are applicable for programs and activities in the first of
two review phases for improper and unknown payments reporting (i.e., Phase 1) as defined by
the Office of Management and Budget (OMB) Memorandum M-21-19, Transmittal of Appendix
C to OMB Circular No. A-123, Requirements for Payment Integrity Improvement (OMB
Memorandum M-21-19). We found that the RRF, SVOG, and payments for covered loans in the
7(a) and 504 loan guaranty programs under the Debt Relief Program were in Phase 1 of review.
Therefore, the compliance requirements 1a, 1b, 3, 4, 5a, 5b, 5c and 6 are not applicable for
these programs and activities.
The compliance requirements 2a and 2b are not applicable for programs and activities in the
second of two review phases for improper and unknown payments reporting (i.e., Phase 2), as
defined by OMB Memorandum M-21-19. We found that the 7(a) loan guaranty approvals, 7(a)
loan guaranty purchases, 504 Certified Development loan approvals, Disaster Assistance
Loans, COVID-EIDL, EIDL Advance, and PPP programs and activities were in Phase 2 of
review.
The compliance requirement 5b is not applicable for the COVID-EIDL, EIDL Advance, and PPP
programs and activities because their improper and unknown payment rate estimates were not
reported in the prior fiscal year.
Our findings, identified internal control deficiencies, and related recommendations are detailed
in Section IV.
1 Based on our evaluation of SBA’s risk assessment process, we concluded these programs were not appropriately assessed by
SBA during Phase 1 of review.
Page | 5
We caution that projecting the results of our performance audit, as described above, to future
periods is subject to the risks that controls may become inadequate due to changes in
conditions or compliance with controls may deteriorate.
SBA’s response to the findings identified in our performance audit is presented in Appendix I.
SBA’s response was not subjected to the auditing procedures applied in this performance audit
and, accordingly, we are unable to determine if management’s response provides a reasonable
basis for our findings and conclusions based on our audit objective.
This report is intended solely for the use of the U.S. Small Business Administration and
Inspector General, Comptroller General, the Office of Management and Budget, and relevant
congressional committees; and is not intended to be and should not be relied upon by anyone
other than these specified parties.
May 15, 2023
Page | 6
I. BACKGROUND
The Payment Integrity Information Act of 2019 (PIIA) Public Law (P.L.) 116-117 repealed the
Improper Payments Elimination and Recovery Act of 2010 (IPERA) P.L. 111-204) (and other
laws) but set forth similar improper payment reporting requirements, including an annual
compliance report by Inspectors General.
PIIA requires an annual compliance report by agency Inspectors General and defines what
constitutes compliance with the requirements. An agency has met the PIIA compliance
requirements if they:
• published improper payments information within an agency financial report (AFR) or
performance and accountability report (PAR) for the fiscal year ended September 30,
2022, and posted that report and any accompanying materials required by OMB on the
agency website;
• conducted a program specific risk assessment for each program that conforms with
section 3352(a) of PIIA (if required);
• published improper payment estimates for all programs identified as susceptible to
significant improper payments under its risk assessment under section 3352(a) of PIIA
(if required);
• published programmatic corrective action plans under section 3352(d) of PIIA in the
AFR or PAR or the accompanying materials (if required);
• published reduction targets under section 3352(d) of PIIA, developed a plan to meet
the reduction targets, and demonstrated improvements for each program assessed to
be at risk and estimated for improper payments (if required and applicable); and
• reported a gross improper payment rate of less than 10 percent for each program and
activity for which an improper payment estimate was published under section 3352(c)
of PIIA.
If an agency does not meet one or more of the six requirements above, then it is not compliant
under PIIA.
On March 5, 2021, OMB issued Memorandum M-21-19, Transmittal of Appendix C to OMB
Circular No. A-123, Requirements for Payment Integrity Improvement (OMB Memorandum M-
21-19), as updated implementation guidance to federal agencies. OMB Memorandum M-21-19
requires agencies to identify susceptible programs with an improper payment risk assessment,
report improper payment estimates, identify root causes of the improper payments, develop,
implement, and monitor corrective actions, and recapture improper payments identified.
We performed our fiscal year (FY) 2022 compliance review using the requirements set forth in
OMB Memorandum M-21-19, OMB Circular No. A-136, Financial Reporting Requirements
(June 3, 2022), OMB Annual Data Call Instructions, OMB Payment Integrity Question and
Answer Platform, and the Council of the Inspectors General on Integrity and Efficiency (CIGIE)
Guidance for Payment Integrity Information Act Compliance Reviews.
Page | 7
II. OBJECTIVE, SCOPE, AND METHODOLOGY
Objective
We conducted this performance audit to determine whether SBA complied with the PIIA for FY
2022.
Scope
The scope of our performance audit was SBA’s FY 2022 improper payments and reporting data
in the payment integrity section of the agency’s FY 2022 AFR and any accompanying materials.
Methodology
During our planning and testing phases, we performed the following to achieve our objective:
• interviewed staff from SBA’s Offices of Performance, Planning, and the Chief Financial
Officer and Capital Access that performed the improper payment reviews;
• collected and inspected SBA provided documentation and evidence, and
• participated in process and control walkthroughs with SBA staff responsible for the
programs identified as susceptible to significant improper payments.
Our detailed procedures consisted of the following:
• obtained an understanding of SBA’s improper payments reporting process and relevant
controls through inquiries with management;
• reviewed SBA’s policies and procedures over the improper payments reporting process;
• reviewed management’s risk assessment for agency programs identified as susceptible
to significant improper payments;
• reviewed related legislation for significant changes or increases in funding levels for
each program;
• reviewed and evaluated the statistically determined improper payment and unknown
payment estimates for each program deemed susceptible to improper payments in
consultation with a statistician;
• reviewed and evaluated the population of outlays for each program for completeness
and accuracy;
• reviewed and evaluated SBA’s payment integrity section in the AFR and accompanying
materials for completeness and accuracy;
• evaluated the corrective actions published and determined whether they focus on the
true root cause, and were implemented;
• evaluated the root cause category classifications and determined whether SBA
accurately classified the true root causes of improper payments, and
• obtained OMB waivers/exemptions for improper payments reporting (if applicable).
We leveraged the CIGIE Guidance for Payment Integrity Information Act Compliance Reviews,
as it provides guidance regarding the fieldwork and reporting related to the performance audit
objective.
Page | 8
We obtained sufficient and appropriate evidence to provide a reasonable basis for our
conclusions related to the audit objective.
III. RESULTS AND CONCLUSIONS
We determined SBA was not compliant under PIIA based on our audit procedures performed.
See below for additional details of our results.
Requirement 1a – Determine if SBA published payment integrity information within the AFR for
the fiscal year ended September 30, 2022.
• Not Compliant. SBA did not publish payment integrity information in its FY 2022 AFR for
the Paycheck Protection Program (PPP) loan guaranty purchases and forgiveness
activities.
Requirement 1b – Determine if SBA posted AFR and any accompanying materials required by
OMB on the agency website.
• Not Compliant. SBA did not publish payment integrity information in the AFR and any
accompanying materials for the PPP loan guaranty purchases and forgiveness activities
on the agency’s website.
Requirement 2a – Determine if SBA conducted a program specific risk assessment for each
program with annual outlays greater than $10 million at least once in the last three years.
• Compliant. SBA performed risk assessments for programs with annual outlays greater
than $10 million. However, the outlays data used in the risk assessments is not reliable.
Requirement 2b – Determine if SBA adequately concluded whether the program is likely to
make improper payments and unknown payments above or below the statutory threshold.
• Not Compliant. SBA did not adequately conclude whether the Restaurant Revitalization
Fund (RRF), Shuttered Venues Operator Grant (SVOG), and the payments for covered
loans in the 7(a) and 504 loan guaranty programs under the Debt Relief Program were
likely to make improper payments and unknown payments above or below the statutory
threshold.
Requirement 3 – Determine if SBA published improper payment and unknown payment
estimates for all programs identified as susceptible to significant improper payments and
unknown payments in the accompanying materials to the AFR.
• Not Compliant. SBA did not implement adequate sampling and estimation methodology
plans that are statistically acceptable to produce improper and unknown payment
estimates that are accurate and representative of the Disaster Assistance Loans,
COVID-Economic Injury Disaster Loans (COVID-EIDL), and Economic Injury Disaster
Loan Emergency Assistance Advance (EIDL Advance) programs.
In addition, SBA did not design and implement adequate review procedures over the
documentation of the sample results used to produce the programs’ improper and
Page | 9
unknown payment estimates to ensure that the procedures could be reperformed and
the results independently validated for the COVID-EIDL and EIDL Advance programs.
The population of outlays reported in the AFR and accompanying materials and
subjected to sampling were not reconciled to the general ledger and were not complete
for the Disaster Assistance Loans, COVID-EIDL, EIDL Advance, and PPP loan guaranty
approvals programs and activities. Consequently, certain transactions were omitted from
the population and excluded from SBA’s review procedures. The unreconciled
populations resulted in an incomplete sample which increases the risk of inaccurate and
unreliable improper payment estimates.
SBA did not design and implement adequate sample review procedures to produce an
accurate and representative estimate of the improper and unknown payments for the
PPP loan guaranty approvals activity.
SBA also did not report improper and unknown payment estimates for the PPP loan
guaranty purchases and forgiveness activities.
Requirement 4 – Determine if SBA published corrective action plans for each program for which
an estimate above the statutory threshold was published in the accompanying materials to the
AFR.
• Not Compliant. SBA did not publish corrective actions for the PPP loan guaranty
purchases and forgiveness activities. Also, the classification of the root cause category
reported in the accompanying materials to the AFR was not appropriate for the 7(a) loan
guaranty approvals, 504 Certified Development loan approvals, Disaster Assistance
Loans, COVID-EIDL, EIDL Advance, and PPP loan guaranty approvals programs and
activities. We observed that the root cause categories reported in the accompanying
materials to the AFR were not consistent with the supporting evidence from the sample
results. However, we found that the corrective action plans published for each program
and activity focused on the true root cause and were implemented appropriately.
Requirement 5a – Determine if SBA published improper payment and unknown payment
reduction targets for each program for which an estimate above the statutory threshold was
published in the accompanying materials to the AFR.
• Not Compliant. SBA did not publish a reduction target for the PPP loan guaranty
purchases and forgiveness activities.
Requirement 5b – Determine if SBA demonstrated improvements to payment integrity or
reached a tolerable improper payment and unknown payment rate.
• Not Compliant. SBA did not demonstrate improvements to payment integrity for the 7(a)
loan guaranty purchases activity.
Requirement 5c – Determine if SBA developed a plan to meet the improper payment and
unknown payment reduction target.
Page | 10
• Not Compliant. SBA did not develop improper payment and unknown payment reduction
targets and a plan to meet reduction targets for the PPP loan guaranty purchases and
forgiveness activities.
Requirement 6 – Determine if SBA reported an improper payment and unknown payment rate
estimate of less than 10 percent for each program for which an improper payment estimate was
published in the accompanying materials to the AFR.
• Not Compliant. The improper and unknown payment rate estimates for the Disaster
Assistance Loans, COVID-EIDL, EIDL Advance, and PPP loan guaranty approvals
programs and activities were not reliable or accurate. Moreover, SBA did not report
improper and unknown payment rate estimates for the PPP loan guaranty purchases
and forgiveness activities.
Our findings identified internal control deficiencies, and related recommendations for each
requirement are detailed in Section IV below.
IV. FINDINGS
See Section III. RESULTS AND CONCLUSIONS (above). Refer to Section IV.A and IV.B for
details on the identified internal control deficiencies, and related recommendations.
A. DEFICIENCIES IN INTERNAL CONTROL
In planning and performing our performance audit of SBA’s FY 2022 compliance with PIIA
reporting, we considered internal controls that were relevant to our audit objective by obtaining
an understanding of those controls and assessing control risk for the purposes of achieving our
objective.
The objective of our audit was not to provide assurance on internal controls; therefore, we did
not express an opinion on internal controls. Our consideration of SBA’s internal controls relevant
to our audit objective would not necessarily disclose all deficiencies that might be significant
within the context of the audit objective.
As a result of our assessment over internal controls relevant to the audit objective and our
compliance test work, we identified the following deficiencies in internal control:
Program or Activity Control Deficiencies
Disaster Assistance 1. The population of outlays reported in the AFR and accompanying
Loans materials and subjected to sampling, were not reconciled to the general
ledger and were not complete.
COVID-EIDL
EIDL Advance
PPP
Page | 11
Program or Activity Control Deficiencies
PPP 2. Management did not effectively review the criteria established for PIIA
reporting and excluded the improper and unknown payment estimates for
the PPP forgiveness and purchase activities.
7(a) Loan Guaranty 3. Management did not have an adequate process in place to communicate
Approvals technical reporting challenges to OMB to ensure that the root causes of
improper payment rates reported in the AFR and accompanying materials
504 Certified were accurate and consistent.
Development Loan
Approvals
Disaster Assistance
Loans
COVID-EIDL
EIDL Advance
PPP
7(a) Loan Guaranty 4. The preventative controls implemented to reduce improper payments as
Purchases the gross improper payment and unknown payment rate increased from
FY 2021 to FY 2022 were not effective.
PPP 5. The process used by management to test samples in accordance with
PIIA requirements was not appropriate. Specifically, a subset of sample
reviews only addressed borrowers’ eligibility but did not address the
accuracy of loan amounts. Also, the testing procedures used a difference
threshold when calculating the maximum loan amount which did not
accurately identify the improper payment amount for the samples
reviewed.
COVID-EIDL 6. The management review process over sample testing was not adequate
to ensure that the relevant transaction-specific risks of each sample were
EIDL Advance addressed to determine whether the payments were improper.
Disaster Assistance 7. The sampling and estimation methodology plans documentation used to
Loans support the development of the improper payment and unknown payment
rate estimates were not appropriately reviewed for sufficiency and the
COVID-EIDL results could not be independently verified.
EIDL Advance 8. The sampling and estimation methodology plans did not provide a
statistically acceptable and accurate estimate of improper and unknown
payments.
PPP 9. The sampling and estimation methodology plan, as implemented by the
statisticians, had extrapolation errors and a management review was not
performed to ensure the results were appropriate.
Various Programs 10. The management review control was not adequately designed and
implemented to ensure that the outlays report used to select programs
subject to risk assessment in FY 2022 was accurate or complete.
Page | 12
Program or Activity Control Deficiencies
Restaurant 11. The review of the risk assessment procedures did not appropriately
Revitalization Fund identify certain risk factors when determining the likelihood of programs to
(RRF) make improper and unknown payments above or below the statutory
threshold.
Shuttered Venue
Operators Grant
Program (SVOG)
Payments for Covered
Loans in the 7(a) and
504 Loan Guaranty
Programs under the
Debt Relief Program
Page | 13
B. RECOMMENDATIONS
We recommend the Administrator coordinate with the Chief Financial Officer to:
1. Enhance existing procedures using the framework in GAO’s Green Book to design and
implement robust internal and quality control processes to ensure complete and
accurate reporting of annual improper payment results and formalized risk assessment
processes to ensure all programs/activities and the related risk factors are appropriately
considered to meet PIIA reporting objectives.
2. Provide training to responsible staff involved in the payment integrity reporting process
regarding the updates to existing procedures.
3. Communicate with OMB to ensure accurate input of improper payment data and
documentation in the accompanying materials related to the payment integrity data call
process.
4. Continue to provide training and collaborate with program office staff, as needed, to
ensure the timely and complete reconciliation of the population of transactions used for
estimating improper payments to the general ledger is performed.
We recommend the Administrator coordinate with the Associate Administrator of the Office of
Capital Access to:
5. Collaborate with the responsible staff involved in the payment integrity reporting process
to ensure timely and complete reconciliations are performed on the populations subject
to sampling for improper payment reviews.
6. Formally document and implement appropriate preventative and monitoring controls
prior to approval of 7(a) loan guaranty purchases.
7. Exercise effective management review controls over the statistician’s work by verifying
that the documentation of the sampling and estimation methodology plans
comprehensively outlines the details of the implemented sampling and extrapolation
methodology, while maintaining statistical validity.
8. Design and document adequate review procedures to ensure that the results of the
sample meet the PIIA objectives.
Page | 14
V. APPENDIX I: MANAGEMENT’S RESPONSE TO REPORT
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416
DATE: May 9, 2023
TO: Hannibal M. Ware, Inspector General
FROM: Katherine Aaby, Associate Administrator for Performance, Planning, and Chief
Financial Officer, OPPCFO
Adrienne Grierson, Deputy Director, Portfolio Management and Quality Control,
OCA through Jihoon Kim, Director, Office of Financial Program Operations,
OCA
SUBJECT: Response to Audit: Performance Audit of the U.S. Small Business
Administration’s Fiscal Year 2022 Compliance with the Payment Integrity
Information Act of 2019
The Small Business Administration (SBA) appreciates the opportunity to review and respond to
the draft Performance Audit of the U.S. Small Business Administration’s Fiscal Year 2022
Compliance with the Payment Integrity Information Act of 2019 (PIIA).
SBA is committed to reducing the dollar amount of improper payments, ensuring program
integrity, and continuing to implement effective risk management procedures in accordance with
improper payment legislation1, as well as guidance prescribed in Office of Management and
Budget Memorandum M-21-19, Appendix C to Circular A-123, Requirements for Payment
Integrity Improvement.
SBA concurs with the Recommendations made in this audit report and is providing the following
comments in response to those recommendations.
Recommendation 1. Enhance existing procedures using the framework in GAO’s Green Book
to design and implement robust internal and quality control processes to ensure complete and
accurate reporting of annual improper payment results and formalized risk assessment processes
to ensure all programs/activities and the related risk factors are appropriately considered to meet
PIIA reporting objectives.
Agency Response. OPPCFO will continue enhancing procedures, as needed, using the
framework in GAO’s Greenbook to design and implement robust internal and quality control
processes to ensure complete and accurate reporting of annual improper payment results and
formalized risk assessment processes to ensure all programs/activities are considered sufficiently
1
Payment Integrity Information Act (2019)
Page | 15
to meet PIIA reporting objectives. Specifically, ICD will revise the qualitative risk assessment
process to ensure consideration for each risk factor is adequate and fair.
Recommendation 2. Provide training to responsible staff involved in the payment integrity
reporting process regarding the updates to existing procedures.
Agency Response. OPPCFO, as an oversight office, will continue to provide training, as
needed, to responsible staff involved in the payment integrity reporting process regarding the
updates to existing procedures. OPPCFO will also continue to host recurring meetings with the
program offices to ensure improper payment related topics are communicated in a timely
manner.
Recommendation 3. Communicate with OMB to ensure accurate input of improper payment
data and documentation in the accompanying materials related to the payment integrity data call
process.
Agency Response. OPPCFO, as an oversight office, will collaborate with SBA Program Offices
to ensure accurate input of improper payment data and documentation in the accompanying
materials related to the payment integrity data call process. As technical reporting challenges
arise that require notification to OMB, OPPCFO will communicate and collaborate with OMB,
as needed, to ensure accurate reporting of payment integrity data.
Recommendation 4. Continue to provide training and collaborate with program office staff, as
needed, to ensure the timely and complete reconciliation of the population of transactions used
for estimating improper payments to the general ledger is performed.
Agency Response. OPPCFO will continue to provide training and collaborate with program
office staff, as needed, to ensure the timely and complete reconciliation of the population of
transactions used for estimating improper payment to the general ledger is performed.
Specifically, ICD will work with other OPPCFO offices to revise the Improper Payments
Outlays report to ensure programs and disbursements are accurate and implement a
reconciliation process as a quality assurance step to ensure accurate reporting.
Recommendation 5. Collaborate with the responsible staff involved in the payment integrity
reporting process to ensure timely and complete reconciliations are performed on the populations
subject to sampling for improper payment reviews.
Agency Response. The Office of Capital Access will work with appropriate staff in the Office
of the Chief Financial Officer to ensure that timely and complete reconcilements are performed
on populations subject to improper payment reviews.
Recommendation 6. Formally document and implement appropriate preventative and
monitoring controls prior to approval of 7(a) loan guaranty purchases.
Agency Response. The Office of Capital Access will formally document and implement
preventative monitoring controls prior to approval of 7(a) loan guaranty purchases.
Page | 16
Recommendation 7. Exercise effective management review controls over the statistician’s
work by verifying that the documentation of the sampling and estimation methodology plans
comprehensively outlines the details of the implemented sampling and extrapolation
methodology, while maintaining statistical validity.
Agency Response. The Office of Capital Access will exercise management review controls over
its statistician’s work by verifying that the sampling and estimation methodology plans
comprehensively outlines the details of the implemented sampling and extrapolation
methodology, while maintaining statistical validity.
Recommendation 8. Design and document adequate review procedures to ensure that the
results of the sample meet the PIIA objectives.
Agency Response. OCA will document its review procedures to ensure that the results of the
sample meet PIIA objectives.
Page | 17
File and source
- File
- SBA-OIG-Report-23-07.pdf
- Size
- 493,071 bytes
- SHA-256
- 1b989f15cdf6c1ef3b5832eafe4ed52f75dc6ddfc9c7073bbe57c05da7c11411
- Our copy
- SBA-OIG-Report-23-07.pdf
- Original
- legacy.sba.gov